38% of Managers Suspect a Fraudulent Hire Is Already on Payroll, and Only 6% Focus on Post-Hire Checks

Most of the conversation about hiring fraud has been about the front door: deepfaked video interviews, AI-polished resumes, a stand-in answering technical questions off camera. Employers have responded by adding ID checks and bringing back in-person rounds. New data suggests that focus leaves a large blind spot. A meaningful share of hiring managers now believe someone who got through the process is already on the payroll, and most organizations have no structured way to find out.

The Fraud That Gets Past the Offer

Checkr's Hiring Hoax 2026 survey, published October 15, polled 3,000 employed U.S. managers who had been involved in hiring in the past 12 months, with fieldwork from September 11 to 16. It found 86% of organizations experienced at least one type of hiring fraud in the past year. Interview proxy fraud, where someone other than the candidate sits the interview, was reported by 67% of managers, up from 35% the year before. Some 40% have personally interviewed a candidate later revealed to be using a fake identity, up from 31%, and 68% agree job seekers are now better at faking identities with AI than hiring teams are at catching them.

The finding that should concern HR most is about people who were hired. 38% of managers believe a fraudulent employee is currently working at their company. 58% think an employee may be holding another job at the same time, and 29% have confirmed at least one case. Asked why candidates misrepresent themselves, 41% of managers pointed to collecting a paycheck without doing the work, 40% to hiding a disqualifying background and 30% to holding multiple jobs without disclosure.

Yet the defenses are concentrated almost entirely up front. 63% of organizations focus fraud prevention mainly before the hire and only 6% emphasize post-hire. 44% have no formal, written process for verifying identity after someone starts. Timing inside the funnel is uneven too: 29% verify identity at the application stage, 49% after at least one live interview and 18% at the final interview or later. Only 23% of managers are extremely confident their process would catch a fraudulent candidate, even though 71% of HR teams now report formal fraud training, up from 17% in 2025.

What a Payroll Insider Looks Like

The most organized version of this problem is the North Korean remote IT worker scheme, and October brought both enforcement and a warning. As The Hacker News reported, federal prosecutors in Ohio charged 14 people in a conspiracy that affected more than 70 U.S. companies and generated about $3 million for the workers between roughly 2019 and July 2025. In raids from September 21 to 25, agents dismantled more than 40 laptop farms across Texas and seized around 187 computers and KVM devices. These are the company laptops new hires are issued, kept running in U.S. homes so remote workers abroad appear to be logging in domestically.

An FBI public service announcement issued October 13 describes how the playbook is evolving. The workers increasingly rely on U.S. facilitators, often people under financial stress, who are asked to appear on camera, sit in on interviews, verify identities, ship packages, complete urinalysis or fingerprint submissions and keep work devices connected from home. The FBI has also seen the workers use stolen identities, extort victims and threaten physical violence to demand payments. It assesses them as a significant insider threat for intellectual property theft and notes they cannot be reliably identified by any single indicator.

That last point is the core of the problem. A facilitator who passes the drug test, the fingerprint check and the in-person interview defeats every pre-hire control on the list. The fraud only shows up later: in where a laptop connects from, who is actually doing the work, or whether the person on a project call is the person who was hired. The FBI's recommended response is an "identity in depth" approach, with layered controls and detection across the entire employment lifecycle rather than a single gate at onboarding.

Why HR Owns the Back Half

It is tempting to treat this as a security team problem. But the Checkr data shows how much of the exposure is created by hiring decisions. 28% of managers knowingly advanced a candidate they suspected of dishonesty because the role needed filling quickly. And when fraud is confirmed, the response is reactive: 48% terminate, 43% investigate internally and only 28% revoke system, data or IP access. Managers' biggest fear is exactly that access, with 26% naming unauthorized entry to systems, data or intellectual property as their top concern.

There is some good news in the same survey. Reported losses above $50,000 fell from 23% to 15%, and the share of companies reporting minimal or no losses rose from 45% to 51%. But 74% of managers still believe hiring fraud is a bigger financial risk than leadership realizes. Spending priorities lag the threat: only 7% of respondents put recruiter and manager training at the top of their fraud budget, behind expanded background checks (33%), in-person verification (29%) and AI fraud detection software (26%).

For HR leaders who want to close the post-hire gap, the practical playbook looks like this:

• Write down post-hire verification. Define when identity is rechecked after day one, such as at equipment delivery, first payroll and system access changes, so it no longer depends on a manager's instinct.
• Verify earlier in the funnel. Move the first identity check to the application or first screen instead of the final interview, so fewer suspect candidates build momentum toward an offer.
• Remove the speed exemption. If 28% of managers advance suspect candidates to fill roles fast, make fraud concerns an explicit stop in the process, with HR sign-off required to proceed.
• Treat devices as an identity signal. Ship equipment only to verified addresses, and work with IT to flag company laptops that connect through remote-access tools or unexpected locations.
• Pair termination with access revocation. Build a joint HR and IT runbook so that a confirmed fraud case cuts system, data and IP access at the same moment as employment.
• Train the managers who hire. Most HR teams now have fraud training, but the people running interviews and approving offers often do not. Extend it to every hiring manager.

The interview will keep getting harder to fake, and that is progress. But an offer letter is not a verdict. Organizations that keep checking who is actually doing the work after day one will be the ones that find a fraudulent hire before it costs them.